Executive brief
The RabbitMQ Java client library uses an insecure default trust manager that accepts any TLS certificate—including self-signed and null certificates—when calling useSslProtocol() without arguments. Combined with disabled hostname verification by default, this enables attackers to intercept all communication via man-in-the-middle attacks. Additionally, the library defaults to plaintext connections and can expose credentials in logs and over the network when using basic authentication.
Technical details
The vulnerability stems from improper certificate validation (CWE-295). The com.rabbitmq.client.TrustEverythingTrustManager class accepts any TLS certificate without validation, and is used as the default when calling ConnectionFactory.useSslProtocol() without arguments. Additionally, hostname verification is disabled by default, requiring explicit enableHostnameVerification() calls. The library defaults to plaintext port 5672 instead of encrypted port 5671, and the getPassword() method returns plaintext credentials without redaction, exposing them in logs and stack traces. Exploitation requires network access to the RabbitMQ server and no authentication is required to perform MITM attacks. An attacker can present a self-signed certificate to intercept all traffic, steal credentials, or perform DNS rebinding attacks. The patch is available in version 5.33.0 and later.
Affected products
- RabbitMQ amqp-client < 5.33.0
Timeline
- 2026-08-18: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-08-18: patched: Patch released in version 5.33.0
References
- https://api.github.com/users/lucianjohnhouse
- https://github.com/lucianjohnhouse
- https://api.github.com/users/lucianjohnhouse/gists%7B/gist_id%7D
- https://api.github.com/users/lucianjohnhouse/repos
- https://avatars.githubusercontent.com/u/244141656?v=4
- https://api.github.com/users/lucianjohnhouse/events%7B/privacy%7D